No_root_squish needs to be a whole share option

During the install and setup I noticed that Rockstor uses the Host/Management host layout for NFS where the hosts shares have root_squish and only the management host has no_root_squish.

While this is good practice when sharing NFS to workstations and stand alone servers, it causes issues when the NFS share is used as persistent storage for Docker, Docker swarm, or Kubernetes pods.

For example, I have a 20 node docker swarm running. Many containers attempt to validate the directory structure or read the initial config directory as they boot (user root) with the root_squish option and proper permissions on the files it blocks the container from accessing the directories/files. These containers have set UID’s and GID’s for the application, but during the initial startup they do some validation as UID=0.

I worked around this by editing the /etc/exports and adding no_root_squish to the entry in the file then doing an exportfs. Im not confident that it will remain after a reboot or when changes are made to the nfs share via the webui.

In my opinion it should be an option for the share and not something that is forced.

2 Likes

Hi @clink,

Thanks for bringing this up and clearly explaining the rationale behind this feature request. I agree with you and we do have room for improvement on the customization of NFS exports.

We actually have an opened issue for such improvement created by @dvgeek, interestingly also stemming from the need to specify the no_root_squash option:
https://github.com/rockstor/rockstor-core/issues/2248

The related forum discussion was:

If I remember correctly, we followed the default recommendation and settings with regards to this option, but I agree with you that we should more easily allow users to specifiy it. It’s already possible (see discussion above), but it’s currently not well documented and not intuitive enough so we should work on that.

1 Like

I noticed you can use the advanced entry but that would mean that I would have to do it for each of my NFS shares. While it is a work around it is a something that needed to be looked into.